Abstract: Disclosed herein are systems and methods for accurately determining a categorization of a network operation based on requestor information rather than network-operation-specific information. One embodiment of the systems and methods disclosed herein features a server configured to transmit an ordered set of prompts to a large language model (LLM) to cause the LLM to determine a general network service description of the requesting computing infrastructure that may be applied to many (if not all) network operation requests originating from the requesting computing infrastructure. The LLM may also output a confidence score corresponding to the previously determined general network service description.

Abstract: Disclosed herein are system and method for enhancing network operation evaluations using machine learning techniques. One embodiment features a server that processes network operation data from various electronic devices using a foundation machine learning model. The model, trained with categorical, numerical, and counter streaming features, generates embeddings capturing real-time and historical context. The embeddings predict risks or outcomes, such as fraud detection or authorization approval. The server transmits these embeddings to downstream models for specialized analysis. The disclosed modular structure supports real-time fraud prediction and network security assessment while maintaining centralized control.

Abstract: Presented herein are systems and methods of generating embeddings for network events to detect fraudulent activities in networked environments. A service may receive a request to execute a first network operation in a network environment. The service may identify an event dataset associated with the first network operation to be executed. The service may apply the first event dataset to a machine learning (ML) model comprising a plurality of weights. The ML model may be established using training data comprising (i) a first sample event dataset associated with a second network operation and (ii) a second sample event dataset corresponding to a modification of a portion of the first sample event dataset. The service may generate, based on applying the event dataset of the first network operation to the ML model, a plurality of embeddings indicative of fraudulence of the first network operation.

Abstract: Presented herein are systems and methods of detecting fraudulent activities in networked environments using embeddings generated from network events. A service may receive, from a first machine learning (ML) model, a plurality of embeddings generated using an event dataset associated with a network operation. The plurality of embeddings may be indicative of fraudulence of the network operation. The service may apply the plurality of embeddings to a second ML model comprising a plurality of weights. The service may determine, based on applying the plurality of embeddings to the second ML model, a score indicating a likelihood of fraudulence in the network operation. The service may execute an action on the network operation in accordance with the score.

Abstract: Discussed herein are methods and systems to train customized machine learning models in a more efficient manner (e.g., using fewer labeled data points). In one example, a method may include using a first machine learning to generate likelihoods of fraudulent activity for an aggregated series of data associated with a series of computing systems. Based on the calculated likelihoods, a server can generate a training dataset that includes fraudulent data associated with a first computing system, fraudulent data associated with any other computing system within the series of computing systems other than the first computing system, non-fraudulent data associated with the first computing system, and non-fraudulent data associated with any other computing system within the series of computing systems other than the first computing system. The server may then train a second machine learning model using the training data, e.g., using a contrastive learning method.

Abstract: This disclosure describes targeted heuristic rule generation tools for fraudulent activity. More specifically, embodiments are directed to a server system for implementing a transaction processing rule (TPR) generator that facilitates generation of transaction processing rules. In many embodiments, these transaction processing rules may be directed to blocking (or allowing) transactions in scenarios that are generally uncommon, but disproportionately affect some entities (e.g., merchants). For example, some merchants may be particularly vulnerable to certain types of fraud that a majority of merchants are not vulnerable to, such as repetitive order and refund fraud schemes. Embodiments may include various components that operate to assist a user (e.g., a merchant) in creating and implementing transaction processing rules tailored to unique or uncommon scenarios they may face.